Your videos and photos

What can leaveOne service can receive a recording, and only if you switch it on

With Transcribed recordings on in Settings → Features, a video or a voice memo you post is sent to ElevenLabs to be transcribed. The transcript then goes to Anthropic, which writes the title and summary; the file itself never does. The two halves run on two different keys and bill separately: the ElevenLabs key stored in Settings → Keys, billed by the minute of recording, and the Anthropic key stored beside it, billed like every other AI job. With the feature off, or with no key stored, the recording is never sent anywhere.

Where the file goesA private bucket on your own storage account, reached through links that expire

An upload that fails still keeps the recording

The take is written to your phone's own storage, or your browser's, before the upload starts. A failed upload used to leave the only copy inside the page you were looking at, so closing the app or reloading the tab destroyed it. Now the next time you open the journal the take is there, with the same Retry beside it. Once the entry exists on the server the local copy is deleted.

A private storage bucket, never a public one

Where this deployment has a media bucket configured, the file uploads over an encrypted connection to a private Cloudflare R2 bucket it owns. Nothing in that bucket has a public address. There is no URL anyone can guess, share, or index. Where it has no bucket, the file stays on the backend's own disk beside the databases, which no one outside the deployment can reach at all.

Filed under your account alone

Every object is keyed under your account's prefix, and only one account exists on your LifeOps — one person, one deployment (see Your login). The backend refuses cross-account reads anyway, defense in depth under that one-account design.

Viewed through expiring links

When a page shows your video, the backend mints a signed link that works for about an hour and then expires. A link copied out of the app stops working on its own. Anyone without your login never gets a link at all.

What deleting removes today

Deleting an entry removes the entry’s row and touches storage not at all, so the recording stays in the bucket with nothing pointing at it. That is a known gap. The private bucket and the expiring links protect the orphaned file the same as any other.

Encrypted at rest

Cloudflare encrypts everything stored in R2. The realistic protections against a stranger are the private bucket and the expiring links. The encryption protects the files if the storage provider's own disks are lost or stolen.

Who touches itTwo named services, and nothing else

Compression happens at home

The backend compresses a recording to browser-playable quality with ffmpeg on your own server, and the original is deleted only after the smaller file is confirmed in storage. That work happens entirely inside your deployment.

ElevenLabs hears the recording, when you switch it on

With Transcribed recordings on in Settings → Features and a key stored for it, the audio is sent to ElevenLabs and comes back as a transcript. Every other AI job sends words; this one sends the file, which is why it has a switch of its own. With the feature off, or with no key stored, the recording is never sent.

Anthropic reads words, never pictures

Two jobs touch a recording. Filing sends the entry’s text and your life areas, and gets back one area. Write-up sends the transcript that came back from ElevenLabs, and gets back a title, a summary and a cleaned-up read-through. Both get words only, never the video and never a frame of it, and each has its own switch in Settings → AI. Photos are different, and a photographed page is stored, shown to you, and sent to nobody for a write-up. The other jobs send words only — an entry, a document or a task’s words for filing, two versions’ text for the version line — so no job here has a photograph to send.

Nothing else

No analytics, no thumbnailing service, no third-party player. The video streams straight from your bucket to your screen.

The boundaryPrivate by architecture, and readable by your own system

What this is not: end-to-end encryption. Your Claude and the backend can read the files they store. That reading is what lets area filing and the app itself work. The honest description is: private by architecture, readable by your own system, sent to the two named services above for the features named here, and to nothing else. Recording transcription is the only job that sends a file. Every other one sends words. Three more AI jobs shipped since: a note gets a summary, an open task gets a status line, and a meeting with a place in its title gets an estimate of when to leave. Each arrived with its own switch, which is the rule. If that boundary should move, it is one sentence to your Claude, and this page changes with it.